sgi-xp: fix writing past the end of kzalloc()'d space